NationalSecurityAgency/ghidra

The problem

Someone hands you a binary — a firmware blob, a suspicious executable, a stripped library from a vendor that will not share source. You need to know what it does. Commercial reverse engineering suites are expensive and license-locked, while disassemblers alone leave you reading assembly by hand. Ghidra attacks this with a full SRE workbench: disassembly, decompilation to C-like code, graphing, scripting, and support for many processor instruction sets and executable formats, all in one installable package.

What's different

Compared with IDA Pro, the long-standing commercial incumbent, Ghidra's advantage is cost and openness: it is free, Apache-2.0, and its decompiler, scripting layer and extension API are available to modify instead of being a black box. Compared with radare2, which is fiercely scriptable and terminal-centric but has a steeper learning curve and less integrated decompilation, Ghidra offers a GUI-heavy, team-oriented workflow — the README explicitly cites scaling and teaming on complex SRE efforts as the reason NSA built it. Also notable is the dual interactive/automated mode, which lets you script headless analysis instead of clicking through every binary, plus first-class Java and Python extension points. The decompiler output is good enough for everyday triage but is not a guarantee of readable source.

Who it's for

Security researchers, malware analysts, vulnerability hunters, and embedded engineers who need to inspect firmware or third-party binaries and cannot justify an IDA license. Teams doing repeated analysis across many samples benefit from the headless scripting. Look elsewhere if you only need a quick hex/strings inspection (lighter tools suffice), if your work is purely dynamic instrumentation, or if you need vendor support and guaranteed turnaround — NSA does not sell support, and the community answers questions.

Cost of adoption

You need JDK 25 64-bit, and the README warns that known security vulnerabilities exist in certain versions — check the advisories before deploying. Building from source adds Gradle 9.1.0+, Python 3.9–3.15, and GCC/Clang or Visual Studio build tools; most users should just download a release zip and run ./ghidraRun. The learning curve is real: the UI is dense, and decompiler output requires assembly literacy to trust. The Eclipse-oriented development workflow feels dated, and release cadence is regular but the project is government-maintained, so expect process over rapid iteration.

Verdict

Ghidra is not a new project — the repo dates to 2019 and has accumulated roughly 94k stars and 10.5k forks, which is an unusually large footprint for a reverse engineering tool. The recent signal is a monthly surge of about 14k stars, ranking #10 across all languages, and a 433-point Hacker News thread; that pattern looks like renewed mainstream attention rather than a brand-new project spiking on novelty. The Apache-2.0 license removes the usual commercial barrier, so the real cost is time to learn the UI and decompiler. If reverse engineering is a recurring part of your job, this is close to a default choice; if it is occasional, budget for the ramp-up.